Weaknesses of type CWE-327

401 results

Uso de algoritmo criptográfico fraco ou quebrado

A aplicação usa algoritmos de criptografia que já foram quebrados ou são reconhecidamente fracos (como MD5, SHA-1, DES, RC4), deixando dados sensíveis vulneráveis a ataques práticos. Mesmo que o algoritmo ainda funcione tecnicamente, um adversário pode recuperar a mensagem ou falsificar assinaturas com esforço computacional viável.

Example

Um sistema armazena senhas de usuários com hash MD5, ou usa SHA-1 para assinar tokens JWT, ou criptografa dados financeiros com DES. Em todos esses casos, há ferramentas públicas que conseguem quebrar a proteção em horas ou dias.

How to mitigate

Substitua por algoritmos modernos: SHA-256 ou melhor para hash (ou Argon2/bcrypt para senhas), AES-256 para criptografia simétrica, ECDSA ou RSA-2048+ para assinaturas. Revise periodicamente o acervo de dependências e remova bibliotecas que só ofereçam primitivas fracas.

CVE-2025-14764MEDIUMMissing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introdEPSS 0.1%CVE-2026-10783LOWgradio-app gradio Audio Cache Key save_audio_to_cache weak hashEPSS 0.1%CVE-2023-23346MEDIUMUse of a broken cryptographic algorithm affects HCL DRYiCE MyCloud EPSS 0.1%CVE-2026-49322MEDIUMIndian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchangeEPSS 0.1%CVE-2026-10803LOWMLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hashEPSS 0.1%CVE-2024-20070MEDIUMIn modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation.EPSS 0.1%CVE-2025-51726HIGHCyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attEPSS 0.1%CVE-2026-40641MEDIUMDell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthEPSS 0.1%CVE-2025-9383LOWFNKvision Y215 CCTV Camera passwd crypt weak hashEPSS 0.1%CVE-2025-9317HIGHAVEVA Edge Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.1%CVE-2026-56609MEDIUMHCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).EPSS 0.1%CVE-2025-7214LOWFNKvision FNK-GU2 MD5 shadow risky encryptionEPSS 0.1%CVE-2026-78236HIGHInsecure PIN derivation mechanism in Admin By Request (ABR)EPSS 0.1%CVE-2025-30156HIGHCeph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgeryEPSS 0.1%CVE-2025-7383MEDIUMTiming side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in Oberon PSA Crypto libraryEPSS 0.1%CVE-2025-7071MEDIUMTiming side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in ocrypto libraryEPSS 0.1%CVE-2026-10814LOWmilvus-io milvus Grantee ID Hash kv_catalog.go weak hashEPSS 0.1%CVE-2024-45394HIGHSecret encryption vulnerable to brute-force attacksEPSS 0.1%CVE-2025-54340MEDIUMA vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There is a Broken or Risky CryptEPSS 0.1%CVE-2026-23601MEDIUMFrame Injection via Shared GTK Allows Traffic Spoofing and Client CompromiseEPSS 0.1%